<!DOCTYPE html>
<html CN>







<head>
	
	
	<link rel="stylesheet" href="/css/allinone.min.css"> 

	
	<!-- Global Site Tag (gtag.js) - Google Analytics -->
	<script async src="https://www.googletagmanager.com/gtag/js?id=UA-42863699-1"></script>
	<script>
		window.dataLayer = window.dataLayer || [];
		function gtag(){dataLayer.push(arguments);}
		gtag('js', new Date());
		gtag('config', 'UA-42863699-1');
	</script>
	

	<meta charset="utf-8" />
	<meta http-equiv="X-UA-Compatible" content="IE=edge" />

	<title>docker 跨主机网络：overlay 简介 | Cizixs Write Here</title>

	<meta name="HandheldFriendly" content="True" />
	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>
	<meta name="generator" content="hexo">
	<meta name="author" content="Cizixs Wu">
	<meta name="description" content="">

	
	<meta name="keywords" content="">
	

	
	<link rel="shortcut icon" href="https://cizixs-blog.oss-cn-beijing.aliyuncs.com/006tNc79ly1g1qxfovpzyj30740743yg.jpg">
	

	
	<meta name="theme-color" content="#3c484e">
	<meta name="msapplication-TileColor" content="#3c484e">
	

	

	

	<meta property="og:site_name" content="Cizixs Write Here">
	<meta property="og:type" content="article">
	<meta property="og:title" content="docker 跨主机网络：overlay 简介 | Cizixs Write Here">
	<meta property="og:description" content="">
	<meta property="og:url" content="http://cizixs.com/2016/06/13/docker-overlay-network/">

	
	<meta property="article:published_time" content="2016-06-13T00:06:00+08:00"/> 
	<meta property="article:author" content="Cizixs Wu">
	<meta property="article:published_first" content="Cizixs Write Here, /2016/06/13/docker-overlay-network/" />
	

	
	
	<script src="https://cdn.staticfile.org/jquery/3.2.1/jquery.min.js"></script>
	

	
	<script src="https://cdn.staticfile.org/highlight.js/9.10.0/highlight.min.js"></script>
	

	
	
<link rel="stylesheet" href="/css/prism-base16-ateliersulphurpool.light.css" type="text/css"></head>
<body class="post-template">
    <div class="site-wrapper">
        




<header class="site-header outer" style="z-index: 999">
    <div class="inner">
        
<nav class="site-nav"> 
    <div class="site-nav-left">
        <ul class="nav">
            <li>
                
                <a href="/" title="Home">Home</a>
                
            </li>
            
            
            <li>
                <a href="/about" title="About">About</a>
            </li>
            
            <li>
                <a href="/archives" title="Archives">Archives</a>
            </li>
            
            
        </ul> 
    </div>
    <div class="site-nav-right">
        
<div class="social-links" >
    
    <a class="social-link" title="weibo" href="https://weibo.com/1921727853" target="_blank" rel="noopener">
        <svg viewBox="0 0 1141 1024" xmlns="http://www.w3.org/2000/svg"><path d="M916.48 518.144q27.648 21.504 38.912 51.712t9.216 62.976-14.336 65.536-31.744 59.392q-34.816 48.128-78.848 81.92t-91.136 56.32-94.72 35.328-89.6 18.944-75.264 7.68-51.712 1.536-49.152-2.56-68.096-10.24-78.336-21.504-79.872-36.352-74.24-55.296-59.904-78.848q-16.384-29.696-22.016-63.488t-5.632-86.016q0-22.528 7.68-51.2t27.136-63.488 53.248-75.776 86.016-90.112q51.2-48.128 105.984-85.504t117.248-57.856q28.672-10.24 63.488-11.264t57.344 11.264q10.24 11.264 19.456 23.04t12.288 29.184q3.072 14.336 0.512 27.648t-5.632 26.624-5.12 25.6 2.048 22.528q17.408 2.048 33.792-1.536t31.744-9.216 31.232-11.776 33.28-9.216q27.648-5.12 54.784-4.608t49.152 7.68 36.352 22.016 17.408 38.4q2.048 14.336-2.048 26.624t-8.704 23.04-7.168 22.016 1.536 23.552q3.072 7.168 14.848 13.312t27.136 12.288 32.256 13.312 29.184 16.384zM658.432 836.608q26.624-16.384 53.76-45.056t44.032-64 18.944-75.776-20.48-81.408q-19.456-33.792-47.616-57.344t-62.976-37.376-74.24-19.968-80.384-6.144q-78.848 0-139.776 16.384t-105.472 43.008-72.192 60.416-38.912 68.608q-11.264 33.792-6.656 67.072t20.992 62.976 42.496 53.248 57.856 37.888q58.368 25.6 119.296 32.256t116.224 0.512 100.864-21.504 74.24-33.792zM524.288 513.024q20.48 8.192 38.912 18.432t32.768 27.648q10.24 12.288 17.92 30.72t10.752 39.424 1.536 42.496-9.728 38.912q-8.192 18.432-19.968 37.376t-28.672 35.328-40.448 29.184-57.344 18.944q-61.44 11.264-117.76-11.264t-88.064-74.752q-12.288-39.936-13.312-70.656t16.384-66.56q13.312-27.648 40.448-51.712t62.464-38.912 75.264-17.408 78.848 12.8zM361.472 764.928q37.888 3.072 57.856-18.432t21.504-48.128-15.36-47.616-52.736-16.896q-27.648 3.072-43.008 23.552t-17.408 43.52 9.728 42.496 39.424 21.504zM780.288 6.144q74.752 0 139.776 19.968t113.664 57.856 76.288 92.16 27.648 122.88q0 33.792-16.384 50.688t-35.328 17.408-35.328-14.336-16.384-45.568q0-40.96-22.528-77.824t-59.392-64.512-84.48-43.52-96.768-15.872q-31.744 0-47.104-15.36t-14.336-34.304 18.944-34.304 51.712-15.36zM780.288 169.984q95.232 0 144.384 48.64t49.152 146.944q0 30.72-10.24 43.52t-22.528 11.264-22.528-14.848-10.24-35.84q0-60.416-34.816-96.256t-93.184-35.84q-19.456 0-28.672-10.752t-9.216-23.04 9.728-23.04 28.16-10.752z" /></svg>
    </a>
    

    
    <a class="social-link" title="github" href="https://github.com/cizixs" target="_blank" rel="noopener">
        <svg viewBox="0 0 1049 1024" xmlns="http://www.w3.org/2000/svg"><path d="M524.979332 0C234.676191 0 0 234.676191 0 524.979332c0 232.068678 150.366597 428.501342 358.967656 498.035028 26.075132 5.215026 35.636014-11.299224 35.636014-25.205961 0-12.168395-0.869171-53.888607-0.869171-97.347161-146.020741 31.290159-176.441729-62.580318-176.441729-62.580318-23.467619-60.841976-58.234462-76.487055-58.234463-76.487055-47.804409-32.15933 3.476684-32.15933 3.476685-32.15933 53.019436 3.476684 80.83291 53.888607 80.83291 53.888607 46.935238 79.963739 122.553122 57.365291 152.97411 43.458554 4.345855-33.897672 18.252593-57.365291 33.028501-70.402857-116.468925-12.168395-239.022047-57.365291-239.022047-259.012982 0-57.365291 20.860106-104.300529 53.888607-140.805715-5.215026-13.037566-23.467619-66.926173 5.215027-139.067372 0 0 44.327725-13.906737 144.282399 53.888607 41.720212-11.299224 86.917108-17.383422 131.244833-17.383422s89.524621 6.084198 131.244833 17.383422C756.178839 203.386032 800.506564 217.29277 800.506564 217.29277c28.682646 72.1412 10.430053 126.029806 5.215026 139.067372 33.897672 36.505185 53.888607 83.440424 53.888607 140.805715 0 201.64769-122.553122 245.975415-239.891218 259.012982 19.121764 16.514251 35.636014 47.804409 35.636015 97.347161 0 70.402857-0.869171 126.898978-0.869172 144.282399 0 13.906737 9.560882 30.420988 35.636015 25.205961 208.601059-69.533686 358.967656-265.96635 358.967655-498.035028C1049.958663 234.676191 814.413301 0 524.979332 0z" /></svg>
    </a>
    

    
    <a class="social-link" title="stackoverflow" href="https://stackoverflow.com/users/1925083/cizixs" target="_blank" rel="noopener">
        <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M15 21h-10v-2h10v2zm6-11.665l-1.621-9.335-1.993.346 1.62 9.335 1.994-.346zm-5.964 6.937l-9.746-.975-.186 2.016 9.755.879.177-1.92zm.538-2.587l-9.276-2.608-.526 1.954 9.306 2.5.496-1.846zm1.204-2.413l-8.297-4.864-1.029 1.743 8.298 4.865 1.028-1.744zm1.866-1.467l-5.339-7.829-1.672 1.14 5.339 7.829 1.672-1.14zm-2.644 4.195v8h-12v-8h-2v10h16v-10h-2z"/></svg>
    </a>
    

    

    
    <a class="social-link" title="twitter" href="https://twitter.com/cizixs" target="_blank" rel="noopener">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path d="M30.063 7.313c-.813 1.125-1.75 2.125-2.875 2.938v.75c0 1.563-.188 3.125-.688 4.625a15.088 15.088 0 0 1-2.063 4.438c-.875 1.438-2 2.688-3.25 3.813a15.015 15.015 0 0 1-4.625 2.563c-1.813.688-3.75 1-5.75 1-3.25 0-6.188-.875-8.875-2.625.438.063.875.125 1.375.125 2.688 0 5.063-.875 7.188-2.5-1.25 0-2.375-.375-3.375-1.125s-1.688-1.688-2.063-2.875c.438.063.813.125 1.125.125.5 0 1-.063 1.5-.25-1.313-.25-2.438-.938-3.313-1.938a5.673 5.673 0 0 1-1.313-3.688v-.063c.813.438 1.688.688 2.625.688a5.228 5.228 0 0 1-1.875-2c-.5-.875-.688-1.813-.688-2.75 0-1.063.25-2.063.75-2.938 1.438 1.75 3.188 3.188 5.25 4.25s4.313 1.688 6.688 1.813a5.579 5.579 0 0 1 1.5-5.438c1.125-1.125 2.5-1.688 4.125-1.688s3.063.625 4.188 1.813a11.48 11.48 0 0 0 3.688-1.375c-.438 1.375-1.313 2.438-2.563 3.188 1.125-.125 2.188-.438 3.313-.875z"/></svg>

    </a>
    

    
    <a class="social-link" title="instagram" href="https://www.instagram.com/cizixs/" target="_blank" rel="noopener">
        <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M12 2.163c3.204 0 3.584.012 4.85.07 3.252.148 4.771 1.691 4.919 4.919.058 1.265.069 1.645.069 4.849 0 3.205-.012 3.584-.069 4.849-.149 3.225-1.664 4.771-4.919 4.919-1.266.058-1.644.07-4.85.07-3.204 0-3.584-.012-4.849-.07-3.26-.149-4.771-1.699-4.919-4.92-.058-1.265-.07-1.644-.07-4.849 0-3.204.013-3.583.07-4.849.149-3.227 1.664-4.771 4.919-4.919 1.266-.057 1.645-.069 4.849-.069zm0-2.163c-3.259 0-3.667.014-4.947.072-4.358.2-6.78 2.618-6.98 6.98-.059 1.281-.073 1.689-.073 4.948 0 3.259.014 3.668.072 4.948.2 4.358 2.618 6.78 6.98 6.98 1.281.058 1.689.072 4.948.072 3.259 0 3.668-.014 4.948-.072 4.354-.2 6.782-2.618 6.979-6.98.059-1.28.073-1.689.073-4.948 0-3.259-.014-3.667-.072-4.947-.196-4.354-2.617-6.78-6.979-6.98-1.281-.059-1.69-.073-4.949-.073zm0 5.838c-3.403 0-6.162 2.759-6.162 6.162s2.759 6.163 6.162 6.163 6.162-2.759 6.162-6.163c0-3.403-2.759-6.162-6.162-6.162zm0 10.162c-2.209 0-4-1.79-4-4 0-2.209 1.791-4 4-4s4 1.791 4 4c0 2.21-1.791 4-4 4zm6.406-11.845c-.796 0-1.441.645-1.441 1.44s.645 1.44 1.441 1.44c.795 0 1.439-.645 1.439-1.44s-.644-1.44-1.439-1.44z"/></svg>
    </a>
    
    
    
</div>
    </div>
</nav>
    </div>
</header>


<main id="site-main" class="site-main outer" role="main">
    <div class="inner">
        <header class="post-full-header">
            <section class="post-full-meta">
                <time  class="post-full-meta-date" datetime="2016-06-12T16:00:00.000Z" itemprop="datePublished">
                    2016-06-13
                </time>
                
                <span class="date-divider">/</span>
                
                <a href="/categories/blog/">blog</a>&nbsp;&nbsp;
                
                
            </section>
            <h1 class="post-full-title">docker 跨主机网络：overlay 简介</h1>
        </header>
        <article class="post-full no-image">
            
            <section class="post-full-content">
                <div id="lightgallery" class="markdown-body">
                    <h2 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h2><p>docker 在早前的时候没有考虑跨主机的容器通信，这个特性直到 docker 1.9 才出现。在此之前，如果希望位于不同主机的容器能够通信，一般有几种方法：</p>
<ul>
<li>使用端口映射：直接把容器的服务端口映射到主机上，主机直接通过映射出来的端口通信</li>
<li>把容器放到主机所在的网段：修改 docker 的 ip 分配网段和主机一致，还要修改主机的网络结构</li>
<li>第三方项目：flannel，weave 或者 pipework 等，这些方案一般都是通过 SDN 搭建 overlay 网络达到容器通信的</li>
</ul>
<p>随着 docker 1.9 的发布，一个新的网络模型被开发出来（后面会写一篇文章专门介绍 docker 的网络项目 libnetwork）。除了能更方便地按照需求来搭建自己的网络方案，这次发布还让 docker 具备了跨主机通信的功能。</p>
<p>这篇文章介绍 docker swarm，和 docker overlay 网络（ docker 自带的跨主机网络模型），看看不同主机是怎么通信的。</p>
<p>使用 overlay 网络需要满足下面的这些条件：</p>
<ul>
<li>正常工作的 key-value 存储服务，比如 consul、etcd、zookeeper 等</li>
<li>可以访问到 key-value 服务的主机集群</li>
<li>集群中每台机器都安装并运行 docker daemon</li>
<li>集群中每台机器的 hostname 都是唯一的，因为 key-value 服务是通过 hostname 标识每台主机的</li>
</ul>
<h2 id="安装-docker-swarm-环境"><a href="#安装-docker-swarm-环境" class="headerlink" title="安装 docker swarm 环境"></a>安装 docker swarm 环境</h2><p>注意： docker overlay 网络可以单独使用，不是必须和 swarm 绑定在一起的。这里使用 swarm，是因为它的简单易用，并且更容易说明问题。</p>
<p>先介绍一下 docker swarm， 这是 docker 开发的容器集群管理工具，和 docker API 兼容性很好，但目前功能不是很强大。</p>
<p><img src="http://blog.daocloud.io/wp-content/uploads/2015/01/swarmarchitecture.jpg" alt=""></p>
<p>废话不多说，我们先来搭建一套 docker swarm 环境。这里的所有操作都是在我的机器上进行的，使用了 docker-machine 在 virtualbox 上面安装主机。docker-machine 提供了方便集成 swarm 的功能，所以安装起来并不复杂。</p>
<p>为了简化这个过程，我写了脚本来一键跑完这个过程（脚本我已经放到 <a href="https://gist.github.com/cizixs/eee61a0ae65c6be30b74b80a9753efb3" target="_blank" rel="noopener">github 上</a>）：</p>
<pre><code>#!/bin/bash

set -e

create_kv() {
    echo Creating kvstore machine.
    docker-machine create -d virtualbox \
        --engine-opt=&quot;registry-mirror=http://houchaohann.m.alauda.cn&quot; \
        kvstore
    docker $(docker-machine config kvstore) run -d \
        -p &quot;8500:8500&quot; \
        progrium/consul --server -bootstrap-expect 1
}

create_master() {
    echo Creating cluster master
    kvip=$(docker-machine ip kvstore)

    docker-machine create -d virtualbox \
        --swarm --swarm-master \
        --swarm-discovery=&quot;consul://${kvip}:8500&quot; \
        --engine-opt=&quot;cluster-store=consul://${kvip}:8500&quot; \
        --engine-opt=&quot;cluster-advertise=eth1:2376&quot; \
        --engine-opt=&quot;registry-mirror=http://houchaohann.m.alauda.cn&quot; \
        swarm-manager
}

create_nodes(){
    kvip=$(docker-machine ip kvstore)
    echo Creating cluster nodes
    for i in 1 2; do
        docker-machine create -d virtualbox \
            --swarm \
            --swarm-discovery=&quot;consul://${kvip}:8500&quot; \
            --engine-opt=&quot;cluster-store=consul://${kvip}:8500&quot; \
            --engine-opt=&quot;cluster-advertise=eth1:2376&quot; \
            --engine-opt=&quot;registry-mirror=http://houchaohann.m.alauda.cn&quot; \
            swarm-node${i}
    done
}


teardown(){
    docker-machine rm kvstore -y
    docker-machine rm -y swarm-manager
    for i in 1 2; do
        docker-machine rm -y swarm-node${i}
    done
}

case $1 in
    up)
        create_kv
        create_master
        create_nodes
        ;;
    down)
        teardown
        ;;
    *)
        echo &quot;Unknow command...&quot;
        exit 1
        ;;
esac
</code></pre><p>运行 <code>./cluster.sh up</code> 就能自动生成四台机器：</p>
<ul>
<li>一台 kvstore运行 consul 服务</li>
<li>一台 swarm master 机器，运行 swarm manager 服务</li>
<li>两台 swarm node 机器，都是运行了 swarm node 服务和 docker daemon 服务</li>
</ul>
<p>注意：上面的脚本设置了某国内厂家的 registry-mirror 来加速镜像的下载，你也可以根据自己的需求进行修改。</p>
<p>怎么验证集群已经正确安装呢？通过 client 和 swarm manager 交互，打印出来集群的状态就搞定了：</p>
<pre><code>➜  eval $(docker-machine env --swarm swarm-manager)
➜  docker info
Containers: 4
 Running: 4
 Paused: 0
 Stopped: 0
Images: 3
Server Version: swarm/1.2.3
Role: primary
Strategy: spread
Filters: health, port, containerslots, dependency, affinity, constraint
Nodes: 3
 swarm-manager: 192.168.99.136:2376
  └ ID: NHHY:6GRG:PVKL:BUIX:Z4TH:626A:BCTR:UFBM:BAP5:H4BJ:DUPO:UMJ2
  └ Status: Healthy
  └ Containers: 2
  └ Reserved CPUs: 0 / 1
  └ Reserved Memory: 0 B / 1.021 GiB
  └ Labels: executiondriver=, kernelversion=4.4.12-boot2docker, operatingsystem=Boot2Docker 1.11.2 (TCL 7.1); HEAD : a6645c3 - Wed Jun  1 22:59:51 UTC 2016, provider=virtualbox, storagedriver=aufs
  └ UpdatedAt: 2016-06-13T04:20:30Z
  └ ServerVersion: 1.11.2
 swarm-node1: 192.168.99.137:2376
  └ ID: O7QX:ZL3Y:WOCG:W4PP:2GDF:RCMM:K5PB:VSZE:GXE5:4M6C:JPHE:BWHM
  └ Status: Healthy
  └ Containers: 1
  └ Reserved CPUs: 0 / 1
  └ Reserved Memory: 0 B / 1.021 GiB
  └ Labels: executiondriver=, kernelversion=4.4.12-boot2docker, operatingsystem=Boot2Docker 1.11.2 (TCL 7.1); HEAD : a6645c3 - Wed Jun  1 22:59:51 UTC 2016, provider=virtualbox, storagedriver=aufs
  └ UpdatedAt: 2016-06-13T04:20:46Z
  └ ServerVersion: 1.11.2
 swarm-node2: 192.168.99.138:2376
  └ ID: RX4S:4UJK:CNCE:IG4V:LP7Y:ZQDL:VGZM:SXUJ:7INW:5PS7:RDLI:AK6A
  └ Status: Healthy
  └ Containers: 1
  └ Reserved CPUs: 0 / 1
  └ Reserved Memory: 0 B / 1.021 GiB
  └ Labels: executiondriver=, kernelversion=4.4.12-boot2docker, operatingsystem=Boot2Docker 1.11.2 (TCL 7.1); HEAD : a6645c3 - Wed Jun  1 22:59:51 UTC 2016, provider=virtualbox, storagedriver=aufs
  └ UpdatedAt: 2016-06-13T04:20:48Z
  └ ServerVersion: 1.11.2
Plugins:
 Volume:
 Network:
Kernel Version: 4.4.12-boot2docker
Operating System: linux
Architecture: amd64
CPUs: 3
Total Memory: 3.063 GiB
Name: 729089ea0dca
Docker Root Dir:
Debug mode (client): false
Debug mode (server): false
WARNING: No kernel memory limit support
</code></pre><p>可以看到和单机的 <code>docker info</code> 不同的是：这里还打印出了集群的信息，以及集群中每台机器的信息。</p>
<p>注意：使用 <code>eval</code> 命令的时候多了 <code>--swarm</code> 参数，这样环境变量就会设置成和 swarm API 打交道啦。</p>
<h2 id="创建-overlay-网络和容器"><a href="#创建-overlay-网络和容器" class="headerlink" title="创建 overlay 网络和容器"></a>创建 overlay 网络和容器</h2><p>好了，环境准备 ok，正式开工吧！<br>下面创建 overlay network <code>multi</code>，然后创建两个容器放到这个网络，最后测试两个容器的连通性！</p>
<p>先创建 overlay 网络：</p>
<pre><code>➜  docker network create -d overlay net1
b29b16fae0516e5cde7d5a044b19fcbb62033ff1b4c3d4ba7a558e396bf47e5f
➜  docker network ls
NETWORK ID          NAME                   DRIVER
b29b16fae051        net1                   overlay
edc4e05afb08        swarm-manager/bridge   bridge
14298a4c6e37        swarm-manager/host     host
c9ca0f7f09b4        swarm-manager/none     null
95429bdaf5cf        swarm-node1/bridge     bridge
641ede08038e        swarm-node1/host       host
aaf1710f8f1b        swarm-node1/none       null
9a12b0e2b2da        swarm-node2/bridge     bridge
a9eafa21c06d        swarm-node2/host       host
7a6015ebbc99        swarm-node2/none       null
</code></pre><p><code>docker network</code> 命令原来管理容器的网络，第一个命令我们创建了一个名字叫 <code>net1</code> 的 overlay，第二个命令查看目前所有的网络。可以发现：</p>
<ul>
<li>每台机器上已经有了 bridge、host、none 三种网络，对应于我们之前<a href="http://cizixs.com/2016/06/12/docker-network-modes-explained">讲过的容器网络模式</a></li>
<li>overlay network 不属于任何一台主机，它属于整个集群</li>
</ul>
<p>注：更多网络的命令可以参考 <code>docker network --help</code> 帮助文档。<strong>为了防止网段冲突，可以使用 <code>--subnet</code> 参数指定创建的网段。</strong></p>
<p>简单起见，我们就创建两个 busybox 容器好了。</p>
<pre><code>➜  docker run -d --net=net1 --name=c1 busybox top
a7de0f1173f62518deb0364ec802133e15605bee5bc20b758cb734f668286b60
➜  docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
a7de0f1173f6        busybox             &quot;top&quot;               8 seconds ago       Up 6 seconds                            swarm-node2/c1
</code></pre><p>只要使用 <code>--net</code> 指定网络名字，我们创建的容器就在对应的网络啦！<code>docker ps</code> 可以看到 <code>NAMES</code> 一栏，容器名字之前还有所在主机的名字。</p>
<p>为了保证第二个容器放到另外一台主机上，我们使用 docker swarm 提供的功能做到这一点。</p>
<pre><code>➜  docker run -d --net=net1 --name=c2 -e constraint:node==swarm-node1 busybox top
20b0c909cbf8e83782f8744cb62cbf2dc142098254c92d74ef30dbfaf3e0c677
➜  docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
20b0c909cbf8        busybox             &quot;top&quot;               4 seconds ago       Up 3 seconds                            swarm-node1/c2
a7de0f1173f6        busybox             &quot;top&quot;               7 minutes ago       Up 7 minutes                            swarm-node2/c1
</code></pre><p>注：更多关于 swarm 调度的内容可以参考<a href="https://docs.docker.com/swarm/scheduler/filter/" target="_blank" rel="noopener">官方教程</a>，这里就不多讲了。</p>
<p>看一下 <code>net1</code> 的详情：</p>
<pre><code>➜  docker network inspect net1
[
    {
        &quot;Name&quot;: &quot;net1&quot;,
        &quot;Id&quot;: &quot;b29b16fae0516e5cde7d5a044b19fcbb62033ff1b4c3d4ba7a558e396bf47e5f&quot;,
        &quot;Scope&quot;: &quot;global&quot;,
        &quot;Driver&quot;: &quot;overlay&quot;,
        &quot;EnableIPv6&quot;: false,
        &quot;IPAM&quot;: {
            &quot;Driver&quot;: &quot;default&quot;,
            &quot;Options&quot;: {},
            &quot;Config&quot;: [
                {
                    &quot;Subnet&quot;: &quot;10.0.0.0/24&quot;,
                    &quot;Gateway&quot;: &quot;10.0.0.1/24&quot;
                }
            ]
        },
        &quot;Internal&quot;: false,
        &quot;Containers&quot;: {
            &quot;20b0c909cbf8e83782f8744cb62cbf2dc142098254c92d74ef30dbfaf3e0c677&quot;: {
                &quot;Name&quot;: &quot;c2&quot;,
                &quot;EndpointID&quot;: &quot;22bf7a8621f4bc1ccdfd5c46d7514da88ab8f0a541da6e0851b6afe4ed3b49ac&quot;,
                &quot;MacAddress&quot;: &quot;02:42:0a:00:00:03&quot;,
                &quot;IPv4Address&quot;: &quot;10.0.0.3/24&quot;,
                &quot;IPv6Address&quot;: &quot;&quot;
            },
            &quot;a7de0f1173f62518deb0364ec802133e15605bee5bc20b758cb734f668286b60&quot;: {
                &quot;Name&quot;: &quot;c1&quot;,
                &quot;EndpointID&quot;: &quot;ccfe9fdb12389c1bada0d4473be16e84d20aff0fef9ae7f86fcfc21e218c4e3e&quot;,
                &quot;MacAddress&quot;: &quot;02:42:0a:00:00:02&quot;,
                &quot;IPv4Address&quot;: &quot;10.0.0.2/24&quot;,
                &quot;IPv6Address&quot;: &quot;&quot;
            }
        },
        &quot;Options&quot;: {},
        &quot;Labels&quot;: {}
    }
]
</code></pre><p>可以看到 overlay 的基本信息，还有我们刚刚创建容器的网络信息也在里面。下面就测试一下两个容器能否互相 ping 通：</p>
<pre><code>➜  docker exec c1 ping -c 3 10.0.0.3
PING 10.0.0.3 (10.0.0.3): 56 data bytes
64 bytes from 10.0.0.3: seq=0 ttl=64 time=0.476 ms
64 bytes from 10.0.0.3: seq=1 ttl=64 time=0.484 ms
64 bytes from 10.0.0.3: seq=2 ttl=64 time=0.615 ms

--- 10.0.0.3 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.476/0.525/0.615 ms

➜  docker exec c2 ping -c 3 10.0.0.2
PING 10.0.0.2 (10.0.0.2): 56 data bytes
64 bytes from 10.0.0.2: seq=0 ttl=64 time=0.572 ms
64 bytes from 10.0.0.2: seq=1 ttl=64 time=0.745 ms
64 bytes from 10.0.0.2: seq=2 ttl=64 time=0.626 ms

--- 10.0.0.2 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.572/0.647/0.745 ms

➜  docker exec c2 ping -c 3 c1
PING c1 (10.0.0.2): 56 data bytes
64 bytes from 10.0.0.2: seq=0 ttl=64 time=1.075 ms
64 bytes from 10.0.0.2: seq=1 ttl=64 time=0.506 ms
64 bytes from 10.0.0.2: seq=2 ttl=64 time=0.502 ms

--- c1 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.502/0.694/1.075 ms
</code></pre><p>注意：在最后一个命令中，直接使用容器的名字也能 ping 通。</p>
<p>实验就此完成，我们已经看到即使在两台不同的主机上，在同一个 overlay 网络中的容器也是联通的。你可以自己多创建几个 overlay 网络，多创建几个更有用的容器试一下。</p>
<p>那么，最后一个部分就讲讲 docker 是怎么实现 overlay 网络的通信的！</p>
<h2 id="overlay-网络模型分析"><a href="#overlay-网络模型分析" class="headerlink" title="overlay 网络模型分析"></a>overlay 网络模型分析</h2><p>先进入到容器里看一下网络情况：</p>
<pre><code>➜  docker exec c1 ip addr
1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
10: eth0@if11: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu 1450 qdisc noqueue
    link/ether 02:42:0a:00:00:02 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.2/24 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:aff:fe00:2/64 scope link
       valid_lft forever preferred_lft forever
13: eth1@if14: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu 1500 qdisc noqueue
    link/ether 02:42:ac:12:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.2/16 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::42:acff:fe12:2/64 scope link
       valid_lft forever preferred_lft forever
</code></pre><p>发现容器有两个网口 <code>eth0</code> 和 <code>eth1</code>，其中 <code>eth0</code> 是我们在 <code>docker network inspect</code> 中看到的，它是 veth pair 中的一个，对应着 <code>if11</code> 网络端口；另外一个属于 <code>172.18.0.1/16</code> 网段，并不是 <code>docker0</code> 所在的 <code>172.17.0.1/16</code>，它对应的 veth pair 是 <code>if14</code>。interesting！这个疑问我们先不要管，继续看网络的路由，发现两个网段也都有自己的路由规则：</p>
<pre><code>➜  docker exec c1 ip route
default via 172.18.0.1 dev eth1
10.0.0.0/24 dev eth0  src 10.0.0.2
172.18.0.0/16 dev eth1  src 172.18.0.2
</code></pre><p>除了多出来一个网段，并没有看到什么奇怪的东西。那么，主机上的情况呢？</p>
<pre><code>docker@swarm-node2:~$ ip addr

3: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:d8:58:ef brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fed8:58ef/64 scope link
       valid_lft forever preferred_lft forever
4: eth1: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:3f:12:de brd ff:ff:ff:ff:ff:ff
    inet 192.168.99.138/24 brd 192.168.99.255 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fe3f:12de/64 scope link
       valid_lft forever preferred_lft forever
5: docker0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:a7:36:e5:66 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:a7ff:fe36:e566/64 scope link
       valid_lft forever preferred_lft forever
7: veth0a68563@if6: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master docker0 state UP group default
    link/ether 9a:39:cb:60:0f:29 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::9839:cbff:fe60:f29/64 scope link
       valid_lft forever preferred_lft forever
12: docker_gwbridge: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:e4:b2:28:24 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.1/16 scope global docker_gwbridge
       valid_lft forever preferred_lft forever
    inet6 fe80::42:e4ff:feb2:2824/64 scope link
       valid_lft forever preferred_lft forever
14: veth3fcaaef@if13: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master docker_gwbridge state UP group default
    link/ether be:a1:f9:a3:a4:3e brd ff:ff:ff:ff:ff:ff
    inet6 fe80::bca1:f9ff:fea3:a43e/64 scope link
       valid_lft forever preferred_lft forever
</code></pre><p>除了 docker0 之外，还多了 <code>docker_gwbridge</code> 这个网口。并且找到了 <code>if14</code> 这个端口，它对应的 <code>if13</code> 就是容器里的 <code>eth1</code>。而且 <code>if13</code> 对应的网段就是 <code>docker_gwbridge</code> 所在的网段，<br>使用  <code>brctl</code> 命令也发现 veth 网口是绑定到 <code>docker_gwbridge</code>，而不是 <code>docker0</code> 的。</p>
<p>现在搞明白了一件事：容器中 <code>eth1</code> 是连接到新创立的 <code>docker_gwbridge</code> 虚拟网桥上，它的作用和之前 docker0 一样，专门做 overlay 网络中的通主机上容器的通信、容器和外部的通信工作。问题是：容器的 <code>eth0</code>，也就是 overlay 网络为什么看不到信息呢？</p>
<p>自然，我们就想到它们一定是在独立的 network namespace，被隐藏了起来。为了方便，我们先把它们找出来，连接到 ip netns 能管理的地方：</p>
<pre><code>sudo ln -s /var/run/docker/netns /var/run/netns
</code></pre><p>然后，执行 <code>ip netns ls</code> 就能看到所有在 netns：</p>
<pre><code>root@swarm-node2:/home/docker# ip netns ls
24aba2d4f90a
1-b29b16fae0
8882bdcea169
</code></pre><p>哎！我们发现了三个 namespace：一个容器 <code>c1</code>，一个属于容器 <code>swarm agent</code>，那么另外一个就属于 <code>overlay</code> 啦！而且很容器猜想那个名称中有 <code>-</code> 符号的很可能是 overlay 网络创建的 namespace：</p>
<pre><code>root@swarm-node2:/home/docker# ip netns exec 1-b29b16fae0 ip addr
1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: br0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1450 qdisc noqueue state UP group default
    link/ether 6e:b8:1f:82:13:63 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.1/24 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::68e0:f0ff:fe19:e88c/64 scope link
       valid_lft forever preferred_lft forever
9: vxlan1: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master br0 state UNKNOWN group default
    link/ether 6e:b8:1f:82:13:63 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::6cb8:1fff:fe82:1363/64 scope link
       valid_lft forever preferred_lft forever
11: veth2@if10: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1450 qdisc noqueue master br0 state UP group default
    link/ether d2:83:53:55:8c:98 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::d083:53ff:fe55:8c98/64 scope link
       valid_lft forever preferred_lft forever
</code></pre><p>果然！我们在这里找到了消失的 <code>if11</code>，之外，还有两个重要的发现：<code>br0</code> 和 <code>vxlan1</code>。通过名字和网段，我们猜测 <code>br0</code> 是这里的虚拟网桥，那么 <code>vxlan1</code> 虽然不知道具体做什么的，但应该和 <code>VxLAN</code> 有关。</p>
<p>这个 namespace 的路由规则很简单，都是发送到 <code>br0</code> 的。</p>
<pre><code>root@swarm-node2:/home/docker# ip netns exec 1-b29b16fae0 ip route
10.0.0.0/24 dev br0  proto kernel  scope link  src 10.0.0.1
</code></pre><p>我们继续看 <code>vxlan1</code> 这个东西，使用 <code>ip -d link</code> 命令查看它的类型：</p>
<pre><code>root@swarm-node2:/home/docker# ip netns exec 1-b29b16fae0 ip -d link
2: br0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1450 qdisc noqueue state UP mode DEFAULT group default
    link/ether 6e:b8:1f:82:13:63 brd ff:ff:ff:ff:ff:ff promiscuity 0
    bridge
9: vxlan1: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master br0 state UNKNOWN mode DEFAULT group default
    link/ether 6e:b8:1f:82:13:63 brd ff:ff:ff:ff:ff:ff promiscuity 1
    vxlan id 256 srcport 0 0 dstport 4789 proxy l2miss l3miss ageing 300
    bridge_slave
11: veth2@if10: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1450 qdisc noqueue master br0 state UP mode DEFAULT group default
    link/ether d2:83:53:55:8c:98 brd ff:ff:ff:ff:ff:ff promiscuity 1
    veth
    bridge_slave
</code></pre><p>发现它是  <code>vxlan</code> 类型的，并且和 <code>veth2</code> 一样是 bridge 的 salve（也就是连到虚拟网桥的）。这里就需要了解一点 vxlan 的知识了：这里的 <code>vxlan1</code> 是一个 <code>VTEP</code>（全称是 VXLAN Tunnel End-Point），VxLAN 的隧道端点，它是 VxLAN 中重要的部分，所有数据报文的校验、封装和转发都是在这里进行的。</p>
<p>注：VxLAN 是一个复杂的概念，这里只需要理解所有的数据报文都是在这里转发，发送到主机的网络就行了。</p>
<p>下面看看 c1（10.0.0.2） 发送的 ping 报文是怎么发送到 c2(10.0.0.3) 的：</p>
<ol>
<li>c1 找到路由发现目的 ip 可以直达，于是发送 arp 报文找到目标的 mac 地址，封包，通过 eth0 发送出去</li>
<li>报文传输到 veth pair 的另外一端 veth2，并发送到其绑定的虚拟交换机 br0</li>
<li><p>br0 会将报文转交给 vxlan1，这里可以参考 arp 地址来确定这一点：</p>
<pre><code> root@swarm-node2:/home/docker# ip netns exec 1-b29b16fae0 ip neigh
 10.0.0.3 dev vxlan1 lladdr 02:42:0a:00:00:03 PERMANENT
</code></pre></li>
<li><p>vxlan 会查询 consul 中保存的目的主机地址，完成报文的封装并通过主机地址 eth1 转发出去</p>
</li>
<li>通过中间网络和路由，报文被发送到目的主机</li>
<li>目的主机介绍到报文，发现是 VxLAN 报文，把它转交给 vxlan 设备，也就是 <code>vxlan1</code> 处理</li>
<li><code>vxlan1</code> 解包，取出里面被封装的报文，把它转交给 <code>br0</code></li>
<li><code>br0</code> 发现本文是发送到连到它上面的某个容器的，将报文交给容器</li>
</ol>
<h2 id="参考资料"><a href="#参考资料" class="headerlink" title="参考资料"></a>参考资料</h2><ul>
<li><a href="http://tonybai.com/2016/02/15/understanding-docker-multi-host-networking/" target="_blank" rel="noopener">理解Docker跨多主机容器网络
</a></li>
<li><a href="http://www.cnblogs.com/ruiqingzhang/p/4463971.html" target="_blank" rel="noopener">利用虚拟网桥实现Docker容器的跨主机访问</a></li>
<li><a href="http://container42.com/2015/10/30/docker-networking-reborn/" target="_blank" rel="noopener">Docker Network Reborn</a></li>
<li><a href="http://blog.daocloud.io/swarm_analysis_part1/" target="_blank" rel="noopener">深入浅出 docker swarm</a></li>
<li><a href="https://docs.docker.com/engine/userguide/networking/get-started-overlay/" target="_blank" rel="noopener">docker 官方一篇关于 overlay 网络的教程</a></li>
</ul>

                </div>
            </section>
        </article>
    </div>
    
<nav class="pagination">
    
    
    <a class="prev-post" title="flannel 网络模型" href="/2016/06/15/flannel-overlay-network/">
        ← flannel 网络模型
    </a>
    
    <span class="prev-next-post">•</span>
    
    <a class="next-post" title="docker 容器的网络模式" href="/2016/06/12/docker-network-modes-explained/">
        docker 容器的网络模式 →
    </a>
    
    
</nav>

    <div class="inner">
    <!-- Begin Mailchimp Signup Form -->
    <link href="//cdn-images.mailchimp.com/embedcode/classic-10_7.css" rel="stylesheet" type="text/css">
    <style type="text/css">
    	#mc_embed_signup{background:#fff; clear:left; font:14px Helvetica,Arial,sans-serif; }
    	/* Add your own Mailchimp form style overrides in your site stylesheet or in this style block.
    	   We recommend moving this block and the preceding CSS link to the HEAD of your HTML file. */
    </style>
    <div id="mc_embed_signup">
    <form action="https://cizixs.us7.list-manage.com/subscribe/post?u=2d561b8dea52d73a2e05e6dcb&amp;id=5c710f135b" method="post" id="mc-embedded-subscribe-form" name="mc-embedded-subscribe-form" class="validate" target="_blank" novalidate>
        <div id="mc_embed_signup_scroll">
    	<h2>订阅本博客，第一时间收到文章更新</h2>
    <div class="indicates-required"><span class="asterisk">*</span> indicates required</div>
    <div class="mc-field-group">
    	<label for="mce-EMAIL">邮件地址  <span class="asterisk">*</span>
    </label>
    	<input type="email" value="" name="EMAIL" class="required email" id="mce-EMAIL">
    </div>
    	<div id="mce-responses" class="clear">
    		<div class="response" id="mce-error-response" style="display:none"></div>
    		<div class="response" id="mce-success-response" style="display:none"></div>
    	</div>    <!-- real people should not fill this in and expect good things - do not remove this or risk form bot signups-->
        <div style="position: absolute; left: -5000px;" aria-hidden="true"><input type="text" name="b_2d561b8dea52d73a2e05e6dcb_5c710f135b" tabindex="-1" value=""></div>
        <div class="clear"><input type="submit" value="Subscribe" name="subscribe" id="mc-embedded-subscribe" class="button"></div>
        </div>
    </form>
    </div>
    <script type='text/javascript' src='//s3.amazonaws.com/downloads.mailchimp.com/js/mc-validate.js'></script><script type='text/javascript'>(function($) {window.fnames = new Array(); window.ftypes = new Array();fnames[0]='EMAIL';ftypes[0]='email';}(jQuery));var $mcj = jQuery.noConflict(true);</script>
    <!--End mc_embed_signup-->
    </div>

    <div class="inner">
        <div id="disqus_thread"></div>
    </div>

    
</main>

<div class="t-g-control">
    <div class="gotop">
        <svg class="icon" width="32px" height="32px" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg"><path d="M793.024 710.272a32 32 0 1 0 45.952-44.544l-310.304-320a32 32 0 0 0-46.4 0.48l-297.696 320a32 32 0 0 0 46.848 43.584l274.752-295.328 286.848 295.808z" fill="#8a8a8a" /></svg>
    </div>
    <div class="toc-control">
        <svg class="icon toc-icon" width="32px" height="32.00px" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg"><path d="M779.776 480h-387.2a32 32 0 0 0 0 64h387.2a32 32 0 0 0 0-64M779.776 672h-387.2a32 32 0 0 0 0 64h387.2a32 32 0 0 0 0-64M256 288a32 32 0 1 0 0 64 32 32 0 0 0 0-64M392.576 352h387.2a32 32 0 0 0 0-64h-387.2a32 32 0 0 0 0 64M256 480a32 32 0 1 0 0 64 32 32 0 0 0 0-64M256 672a32 32 0 1 0 0 64 32 32 0 0 0 0-64" fill="#8a8a8a" /></svg>
        <svg class="icon toc-close" style="display: none;" width="32px" height="32.00px" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg"><path d="M512 960c-247.039484 0-448-200.960516-448-448S264.960516 64 512 64 960 264.960516 960 512 759.039484 960 512 960zM512 128.287273c-211.584464 0-383.712727 172.128262-383.712727 383.712727 0 211.551781 172.128262 383.712727 383.712727 383.712727 211.551781 0 383.712727-172.159226 383.712727-383.712727C895.712727 300.415536 723.551781 128.287273 512 128.287273z" fill="#8a8a8a" /><path d="M557.05545 513.376159l138.367639-136.864185c12.576374-12.416396 12.672705-32.671738 0.25631-45.248112s-32.704421-12.672705-45.248112-0.25631l-138.560301 137.024163-136.447897-136.864185c-12.512727-12.512727-32.735385-12.576374-45.248112-0.063647-12.512727 12.480043-12.54369 32.735385-0.063647 45.248112l136.255235 136.671523-137.376804 135.904314c-12.576374 12.447359-12.672705 32.671738-0.25631 45.248112 6.271845 6.335493 14.496116 9.504099 22.751351 9.504099 8.12794 0 16.25588-3.103239 22.496761-9.247789l137.567746-136.064292 138.687596 139.136568c6.240882 6.271845 14.432469 9.407768 22.65674 9.407768 8.191587 0 16.352211-3.135923 22.591372-9.34412 12.512727-12.480043 12.54369-32.704421 0.063647-45.248112L557.05545 513.376159z" fill="#8a8a8a" /></svg>
    </div>
    <div class="gobottom">
        <svg class="icon" width="32px" height="32.00px" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg"><path d="M231.424 346.208a32 32 0 0 0-46.848 43.584l297.696 320a32 32 0 0 0 46.4 0.48l310.304-320a32 32 0 1 0-45.952-44.544l-286.848 295.808-274.752-295.36z" fill="#8a8a8a" /></svg>
    </div>
</div>
<div class="toc-main" style="right: -100%">
    <div class="post-toc">
        <span>TOC</span>
        <ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#简介"><span class="toc-text">简介</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#安装-docker-swarm-环境"><span class="toc-text">安装 docker swarm 环境</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#创建-overlay-网络和容器"><span class="toc-text">创建 overlay 网络和容器</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#overlay-网络模型分析"><span class="toc-text">overlay 网络模型分析</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#参考资料"><span class="toc-text">参考资料</span></a></li></ol>
    </div>
</div>



        

<aside class="read-next outer">
    <div class="inner">
        <div class="read-next-feed">
            
            

<article class="read-next-card"  style="background-image: url(https://cizixs-blog.oss-cn-beijing.aliyuncs.com/006tNc79ly1g1qxcn9ft3j318w0txdo6.jpg)"  >
  <header class="read-next-card-header">
    <small class="read-next-card-header-sitetitle">&mdash; Cizixs Write Here &mdash;</small>
    <h3 class="read-next-card-header-title">Recent Posts</h3>
  </header>
  <div class="read-next-divider">
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
      <path d="M13 14.5s2 3 5 3 5.5-2.463 5.5-5.5S21 6.5 18 6.5c-5 0-7 11-12 11C2.962 17.5.5 15.037.5 12S3 6.5 6 6.5s4.5 3.5 4.5 3.5"/>
    </svg>
  </div>
  <div class="read-next-card-content">
    <ul>
      
      
      
      <li>
        <a href="/2018/08/26/what-is-istio/">什么是 istio</a>
      </li>
      
      
      
      <li>
        <a href="/2018/08/25/knative-serverless-platform/">serverless 平台 knative 简介</a>
      </li>
      
      
      
      <li>
        <a href="/2018/06/25/kubernetes-resource-management/">kubernetes 资源管理概述</a>
      </li>
      
      
      
      <li>
        <a href="/2018/01/24/use-prometheus-and-grafana-to-monitor-linux-machine/">使用 promethues 和 grafana 监控自己的 linux 机器</a>
      </li>
      
      
      
      <li>
        <a href="/2018/01/13/linux-udp-packet-drop-debug/">linux 系统 UDP 丢包问题分析思路</a>
      </li>
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
    </ul>
  </div>
  <footer class="read-next-card-footer">
    <a href="/archives">  MORE  → </a>
  </footer>
</article>


            
            
            
        </div>
    </div>
</aside>


<footer class="site-footer outer">

	<div class="site-footer-content inner">
		<section class="copyright">
			<a href="/" title="Cizixs Write Here">Cizixs Write Here</a>
			&copy; 2019
		</section>
		<nav class="site-footer-nav">
			
            <a href="https://hexo.io" title="Hexo" target="_blank" rel="noopener">Hexo</a>
            <a href="https://github.com/xzhih/hexo-theme-casper" title="Casper" target="_blank" rel="noopener">Casper</a>
        </nav>
    </div>
</footer>






<div class="floating-header" >
	<div class="floating-header-logo">
        <a href="/" title="Cizixs Write Here">
			
                <img src="https://cizixs-blog.oss-cn-beijing.aliyuncs.com/006tNc79ly1g1qxfovpzyj30740743yg.jpg" alt="Cizixs Write Here icon" />
			
            <span>Cizixs Write Here</span>
        </a>
    </div>
    <span class="floating-header-divider">&mdash;</span>
    <div class="floating-header-title">docker 跨主机网络：overlay 简介</div>
    <progress class="progress" value="0">
        <div class="progress-container">
            <span class="progress-bar"></span>
        </div>
    </progress>
</div>
<script>
   $(document).ready(function () {
    var progressBar = document.querySelector('progress');
    var header = document.querySelector('.floating-header');
    var title = document.querySelector('.post-full-title');
    var lastScrollY = window.scrollY;
    var lastWindowHeight = window.innerHeight;
    var lastDocumentHeight = $(document).height();
    var ticking = false;

    function onScroll() {
        lastScrollY = window.scrollY;
        requestTick();
    }
    function requestTick() {
        if (!ticking) {
            requestAnimationFrame(update);
        }
        ticking = true;
    }
    function update() {
        var rect = title.getBoundingClientRect();
        var trigger = rect.top + window.scrollY;
        var triggerOffset = title.offsetHeight + 35;
        var progressMax = lastDocumentHeight - lastWindowHeight;
            // show/hide floating header
            if (lastScrollY >= trigger + triggerOffset) {
                header.classList.add('floating-active');
            } else {
                header.classList.remove('floating-active');
            }
            progressBar.setAttribute('max', progressMax);
            progressBar.setAttribute('value', lastScrollY);
            ticking = false;
        }

        window.addEventListener('scroll', onScroll, {passive: true});
        update();

        // TOC
        var width = $('.toc-main').width();
        $('.toc-control').click(function () {
            if ($('.t-g-control').css('width')=="50px") {
                if ($('.t-g-control').css('right')=="0px") {
                    $('.t-g-control').animate({right: width}, "slow");
                    $('.toc-main').animate({right: 0}, "slow");
                    toc_icon()
                } else {
                    $('.t-g-control').animate({right: 0}, "slow");
                    $('.toc-main').animate({right: -width}, "slow");
                    toc_icon()
                }
            } else {
                if ($('.toc-main').css('right')=="0px") {
                    $('.toc-main').slideToggle("fast", toc_icon());
                } else {
                    $('.toc-main').css('right', '0px');
                    toc_icon()
                }
            }
        })

        function toc_icon() {
            if ($('.toc-icon').css('display')=="none") {
                $('.toc-close').hide();
                $('.toc-icon').show();
            } else {
                $('.toc-icon').hide();
                $('.toc-close').show();
            }
        }

        $('.gotop').click(function(){
            $('html,body').animate({scrollTop:$('.post-full-header').offset().top}, 800);
        });
        $('.gobottom').click(function () {
            $('html,body').animate({scrollTop:$('.pagination').offset().top}, 800);
        });

        // highlight
        // https://highlightjs.org
        $('pre code').each(function(i, block) {
            hljs.highlightBlock(block);
        });
        $('td.code').each(function(i, block) {
            hljs.highlightBlock(block);
        });

        console.log("this theme is from https://github.com/xzhih/hexo-theme-casper")
    });
</script>



<link rel="stylesheet" href="https://cdn.staticfile.org/lightgallery/1.3.9/css/lightgallery.min.css">



<script src="https://cdn.staticfile.org/lightgallery/1.3.9/js/lightgallery.min.js"></script>


<script>
	$(function () {
		var postImg = $('#lightgallery').find('img');
		postImg.addClass('post-img');
		postImg.each(function () {
			var imgSrc = $(this).attr('src');
			$(this).attr('data-src', imgSrc);
		});
		$('#lightgallery').lightGallery({selector: '.post-img'});
	});
</script>



<script>

/**
*  RECOMMENDED CONFIGURATION VARIABLES: EDIT AND UNCOMMENT THE SECTION BELOW TO INSERT DYNAMIC VALUES FROM YOUR PLATFORM OR CMS.
*  LEARN WHY DEFINING THESE VARIABLES IS IMPORTANT: https://disqus.com/admin/universalcode/#configuration-variables*/

var disqus_config = function () {
this.page.url = 'http://cizixs.com/2016/06/13/docker-overlay-network/';  // Replace PAGE_URL with your page's canonical URL variable
this.page.identifier = 'http://cizixs.com/2016/06/13/docker-overlay-network/'; // Replace PAGE_IDENTIFIER with your page's unique identifier variable
};

(function() { // DON'T EDIT BELOW THIS LINE
var d = document, s = d.createElement('script');
s.src = 'https://cizixs.disqus.com/embed.js';
s.setAttribute('data-timestamp', +new Date());
(d.head || d.body).appendChild(s);
})();
</script>
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
                            


    </div>
</body>
</html>
